{"id":20742998,"url":"https://github.com/pandh4cker/pandshark","last_synced_at":"2026-04-28T03:04:43.423Z","repository":{"id":107313618,"uuid":"414270724","full_name":"PandH4cker/PandShark","owner":"PandH4cker","description":null,"archived":false,"fork":false,"pushed_at":"2021-11-02T13:22:45.000Z","size":5193,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-18T02:22:02.247Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PandH4cker.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-06T15:35:25.000Z","updated_at":"2021-11-02T18:15:00.000Z","dependencies_parsed_at":null,"dependency_job_id":"1ff028f2-d864-4824-8b20-120bcd420f71","html_url":"https://github.com/PandH4cker/PandShark","commit_stats":null,"previous_names":["pandh4cker/pandshark"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PandH4cker%2FPandShark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PandH4cker%2FPandShark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PandH4cker%2FPandShark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PandH4cker%2FPandShark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PandH4cker","download_url":"https://codeload.github.com/PandH4cker/PandShark/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243034555,"owners_count":20225370,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-17T07:08:45.194Z","updated_at":"2025-12-26T03:34:13.528Z","avatar_url":"https://github.com/PandH4cker.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PandShark \n## Author: [Raphael Dray](https://www.linkedin.com/in/raphaeldray/)\n\nPandShark is a tool designed to analyze/read pcap files.\n\nIt can parse from **PCAP** file format:\n\nPandShark, in its minimal display, will always print:\n* _Packet index_ (from the list of read packets)\n* _IP/MAC address_\n* _Protocol_\n* _Packet Length_\n* _Date_\n\n\n* **ARP**\n  * **Printed Fields**:\n    * _ARP Info_ (i.e. Who has 24.166.175.220? Tell 69.76.216.1), useful for the comprehension.\n* **DHCP**\n  * _Printed Fields_:\n    * _Message Type (Discover, Offer...)_, useful for understanding the request/response.\n    * _Transaction ID_, useful for following the response/request.\n* **DNS**\n  * _Printed Fields_:\n    * _DNS Query Type (i.e. Standard Query...)_, useful for understanding the type of the query.\n    * _Query ID_, useful for following the response/request.\n    * _Query Class_, useful for understanding the response needed to be given then.\n    * _DNS Query Name_, useful for reading which server are we requesting.\n      * For each **DNS Answers (A, AAAA, CNAME...)**:\n        * Print the information about the answer\n* **FTP**\n  * _FTP Message with indication about Request/Response_, useful for reading the message sent and received.\n* **HTTP**\n  * _HTTP Message split on CRLF_, useful for reading the message sent and received.\n* **ICMP**\n  * **Printed Fields**:\n    * _Type/Code Combination (i.e. Echo Reply/Echo Request)_, useful for determining the purpose of the ICMP packet.\n    * _ID_, useful since the ID could reference in certain cases the PID of the process sending the packet.\n    * _Sequence Number_, useful in order to determine if we lost packets.\n    * _Time To Live_, useful in case you want to fingerprint the OS of the sender/receiver (**From IPV4**).\n* **ETHERNET**\n* **TCP**\n* **UDP**\n* **IPV4**\n\nIn its verbose mode (_display nth_), every protocol header about a specific \npacket and all their info are printed to visualize all fields.\n\nMoreover, it includes a [protocol detection system](https://github.com/MrrRaph/PandShark/blob/master/src/core/headers/layer4/ProtocolDetector.java) \nin order to detect protocols encapsulated into TCP/UDP frames.\n\nIt includes also some PCAP samples to test different protocol detections.\n\n## Installation:\nYou'll need to have Java 17 with preview enabled to run this program (--enable-preview).\n\nClone this repository:\n```bash\ngit clone git@github.com:MrrRaph/PandShark.git\n```\n\nThen run the main class **PcapReader** in src.core.PcapReader.\n\n## Usage:\nGive a pcap as an argument to PandShark.\n\nPandShark give you a prompt in order to navigate through the packets:\n```\n1426 packets read\nPandShark \u003e\u003e display\n1\t10.0.4.46 -\u003e 8.8.8.8\tDNS 92 Standard Query 0x9200 A google.fr\n2\t8.8.8.8 -\u003e 10.0.4.46\tDNS 96 Standard Query 0x9200 A google.fr A Address: 142.250.201.163\n3\t08:00:27:43:73:BC -\u003e 00:00:00:00:00:00\t ARP 42 Who has 10.0.4.254? Tell 10.0.4.46\n4\t00:26:55:E6:02:A0 -\u003e 08:00:27:43:73:BC\t ARP 60 10.0.4.254 is at 00:26:55:E6:02:A0\n5\t00:26:55:E6:02:A0 -\u003e 00:00:00:00:00:00\t ARP 60 Who has 10.0.4.46? Tell 10.0.4.254\n6\t08:00:27:43:73:BC -\u003e 00:26:55:E6:02:A0\t ARP 42 10.0.4.46 is at 08:00:27:43:73:BC\n7\t08:00:27:AC:C2:F6 -\u003e FF:FF:FF:FF:FF:FF\t ARP 60 Who has 10.0.4.27? Tell 0.0.0.0\n8\t08:00:27:AC:C2:F6 -\u003e FF:FF:FF:FF:FF:FF\t ARP 60 Who has 10.0.4.27? Tell 0.0.0.0\n9\t10.0.4.46 -\u003e 8.8.8.8\tDNS 72 Standard Query 0xFA49 A whois.nic.fr\n10\t10.0.4.46 -\u003e 8.8.8.8\tDNS 72 Standard Query 0xB04A AAAA whois.nic.fr\n...\n\nPandShark \u003e\u003e display 10\nFrame 10: 72 bytes on wire (576 bits)\n\tEncapsulation type: Ethernet (1)\n** Ethernet Header **\n\tDestination IP: 00:26:55:E6:02:A0\n\tSource IP: 08:00:27:43:73:BC\n\tEtherType: 0x0800 (IPv4)\n** IPv4 Header **\n\tIP version: IPv4\n\tIHL: 20 bytes\n\tService: 0x00\n\tTotal Length: 58 bytes\n\tIdentification: 42947\n\tFlags:\n\t\tDon't Fragment: false\n\t\tMore Fragment: false\n\tPosition Fragment: 16384\n\tTTL: 64\n\tProtocol: UDP\n\tChecksum: 0x74B2\n\tSource IP: 10.0.4.46\n\tDestination IP: 8.8.8.8\n** UDP Header **\n\tSource Port: 51451\n\tDestination Port: 53\n\tLength: 38\n\tChecksum: 0x1E75\n** DNS Header **\n\tTransaction ID = 0xB04A\n\tFlags = \n\t\tResponse = Query\n\t\tOpcode = Standard Query\n\t\tTruncated = false\n\t\tRecursion Desired = true\n\t\tZ = 0\n\t\tRcode = No Error\n\tQuestions = 1\n\tAnswer RRs = 0\n\tAuthority RRs = 0\n\tAdditional RRs = 0\n\t** Query N°1 **\n\t\tName = whois.nic.fr\nType = IPv6 Address (AAAA)\nClass = Internet (IN)\n```\n\nYou can invoke the help command:\n```\nPandShark \u003e\u003e help\ndisplay [frameNumber]\tDisplay all the packets read or the nth packets\nhelp\tDisplay this help prompt\nexit\tQuit the program\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpandh4cker%2Fpandshark","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpandh4cker%2Fpandshark","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpandh4cker%2Fpandshark/lists"}